Microsoft Entra ID SSO

Before you begin

You need your socure_public_account_id, available in the RiskOS™ Dashboard on the Developer Workbench > API Keys page under the Customer ID section.

• Access Sandbox socure_public_account_id.

• Access Production socure_public_account_id.

Set Up Single Sign-On (SSO) with Microsoft Entra ID

1. Configure SAML in Microsoft Entra ID

Follow these steps to create a SAML 2.0 integration in Microsoft Entra ID:

1. Log into your Entra ID account.

2. Go to Identity > Applications > Enterprise applications.

3. Click New application, then select Create your own application.

4. On the Create your own application page:

   • Enter a name for your new application.
   • Select Integrate any other application you don't find in the gallery.

5. Click Create. Once the application's Overview page appears, the application is successfully created.

6. Under Getting Started, click Set up Single Sign-On.

7. Under Basic SAML Configuration, click Edit.

8. On the Basic SAML Configuration page, enter the following values:

9. Click X to close the page.

10. Under Attributes & Claims, click Edit.

11. On the Attributes & Claims page, click Unique User Identifier (Name ID).

12. On the Manage Claim page:

• Set Name identifier format to Email address.
• Select Attribute as Source.
• Set Source attribute to user.mail (or user.userprincipalname if email addresses are not populated in the mail attribute).

13. Click Save.

14. On the Attributes & Claims page, go to Additional claims and update all claims to your SAML attributes.

2. Configure SAML attribute statements

Under Additional claims, configure the following claims. In Entra, you set each claim's value by choosing a directory field from the Source attribute dropdown on the Manage claim page.

To manage which role(s) a user has when they access RiskOS™, add a claim that carries the role:

1. On the Attributes & Claims page, click Add new claim.
2. Set Name to https://dashboard.socure.com/attributes/role and leave Namespace empty. Clear any default value Entra pre-fills in the Namespace field so that Entra emits the claim with exactly the name https://dashboard.socure.com/attributes/role, which is the name Socure expects.
3. Set the claim's Source so that its value resolves to one of the valid RiskOS™ role names in the table below. The value must match a role name exactly — enter it in lowercase, with spaces preserved (for example, fraud analyst). Role matching is case-sensitive.

The following table lists the valid role names available in RiskOS™. Use the role name exactly as shown as the claim value (see also Roles and permissions):

3. Send the SAML Metadata to Socure

Once the SAML app integration is created, generate the SAML metadata file and securely share it with Socure.

Steps to retrieve and send metadata

1. From the side navigation menu, click Single sign-on.
2. Under SAML Signing Certificate, click Download to download the Federation Metadata XML.
3. Send the metadata file to Socure using a secure communication method.

Don't copy and paste just the X.509 certificate from the SAML Setup Instructions page. Socure requires the full SAML metadata file (XML format), which includes your entity ID, endpoints, and certificates. Be sure to download and share the complete metadata file.

After receiving your SAML metadata file, your Technical Account Manager will confirm when SAML is enabled for your account.

4. Test the integration

To test the SAML integration, go to Entra ID, create a user, assign Socure's RiskOS™ app to the user, and set the role via the role claim. When the user launches the RiskOS™ app, the following occurs:

The Users tab on the Users page in RiskOS™ is populated with the user's name, email address, and phone number.
The user is assigned the role(s) specified in the role claim. If a role is not assigned, the system defaults to assigning the fraud analyst role to the user.

5. Assign users to RiskOS™

If you are planning to manage role assignment to users and you have configured the role claim, you can assign role(s) to the user when assigning the application. If a role is not assigned, the system defaults to assigning the fraud analyst role to the user.